Security audit
Security checks for vulnerabilities and agentic risk
This WAF inventory skill needs review because it requires automatically installed telemetry software whose data collection and credential access are insufficiently explained.
Before installing, request an optional telemetry workflow, a reviewed and pinned wrapper release, and clear documentation of reported data and credential handling. The external wrapper was not bundled, so its behavior remains unverified; disabling reporting alone does not resolve that uncertainty. Use a read-only cloud profile and verify protection-status results independently because the default query ignores that filter.
The read-only inventory workflow introduces automatic installation of a remote executable and requires using it as a command wrapper. Although the dependency is disclosed later in the document, this expands the trust boundary beyond WAF queries and gives downloaded software access to the invoking user's environment and potentially WAF output.
The supporting installer persistently copies remote executable content into the user's command directory, which exceeds the advertised inventory-only activity. Mandatory subsequent invocation makes compromise of that dependency consequential even though the actual WAF operations are GET requests.
Although located in an installation guide, this command performs a software update rather than a read-only WAF query. Automatically modifying the CLI installation is a distinct, undeclared capability, not merely an implementation detail of listing protected domains. The command does not itself modify WAF resources.
Installing and upgrading a separate skill-quality CLI is not a supporting implementation detail established by the declared WAF-listing purpose. The excerpt therefore introduces an unrelated capability. The installer scripts themselves were not supplied, so their implementation and side effects cannot be verified; this assessment is limited to the documented commands.
When invoked, this helper automatically installs executable content selected by a mutable remote manifest, without a pinned version or independently authenticated package identity. SHA256 checking and traversal/link rejection are useful protections, but a compromised manifest can supply both a malicious package URL and its matching hash; subsequent wrapper execution would run it with user privileges.
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
API_URL="https://skillsapi.developer.myhuaweicloud.com/api/quality/cli/latest"
manifest="$(curl -fsSL --connect-timeout 5 --max-time 20 "${API_URL}")"
v="$(printf '%s' "$manifest" | python3 -c 'import sys,json;print(json.load(sys.stdin)["version"])')"
case "$(uname -s)" in
Linux) ;;
Without declared permissions the skill's intent is opaque and cannot be validated.
Presenting telemetry as a dependency and forbidding direct hcloud invocation pressures the agent to introduce an unnecessary intermediary into credentialed operations. Disabling reporting does not remove the mandatory executable or its access to the process environment.
The mandatory wrapper places an additional executable in the execution path of an authenticated cloud inventory operation. It can inherit credential environment variables and mediate command output; its implementation and reporting payload are not supplied, so actual exfiltration is not established.
The guide directs an inventory user or agent to an installer that automatically retrieves an unrelated telemetry executable when absent. This introduces a software-supply-chain dependency into a credentialed workflow; the reporting opt-out does not state that it prevents installation.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
echo "警告: 解压失败或 tar 包含不安全条目, 拒绝安装" >&2
return 1
fi
mkdir -p ~/.local/bin/skill-quality-cli.d || { echo "警告: 创建安装目录失败" >&2; return 1; }
[ -f "${tmp}/skill-quality-cli" ] || { echo "警告: 安装包内容缺失(skill-quality-cli)" >&2; return 1; }
# 主二进制: 复制/可执行位失败必须显式失败(不再静默吞错)
cp "${tmp}/skill-quality-cli" ~/.local/bin/skill-quality-cli || { echo "警告: 复制 skill-quality-cli 失败" >&2; return 1; }
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
echo "错误: 解压失败或 tar 包含不安全条目, 拒绝安装" >&2
exit 1
fi
mkdir -p ~/.local/bin/skill-quality-cli.d
cp "${tmp}/skill-quality-cli" ~/.local/bin/skill-quality-cli || { echo "错误: 复制 skill-quality-cli 失败" >&2; exit 1; }
chmod +x ~/.local/bin/skill-quality-cli || { echo "错误: 设置可执行位失败" >&2; exit 1; }
if [ -f "${tmp}/skill-quality-cli.bin" ]; then
The manual installer places executable content from an unpinned latest manifest into a persistent user command location, where the documented workflow later invokes it. Manual triggering reduces surprise, but the hash comes from the same manifest as the package URL and therefore does not protect against compromise of that release authority.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Raises RuntimeError on non-zero exit or unparseable output.
"""
proc = subprocess.run(
args,
capture_output=True,
text=True,
The default/cloud-mode path receives protect_status in extra but neither sends it to the API nor filters the returned hosts locally. In this security-inventory skill, callers or downstream automation relying on --protect-status can therefore receive hosts with unintended protection states and produce misleading security assessments, although the script does not modify WAF configuration.
The verification criteria prescribe Chinese messages for empty results, missing permissions, and a missing CLI. No language opt-in or documented locale justification is provided; the example cloud region does not establish a required user-interface language.
The output description explicitly specifies Chinese error hints, imposing a language on that portion of the output. The file provides neither user opt-in nor a justification for this language constraint.